Subject: [XCON] Comments on draft-koskelainen-xcon-cpcp-reqs-00

From: eburger at snowshore.com (Eric Burger)
Date: Mon Jul 14 10:10:08 2003

General:
There are a lot of references to passwords in the document.  I would suggest also considering certificates.  Language such as "appropriate authentication" can dodge this issue.

REQ-B8 open issue
Yes, it is absolutely of value to specify maximum conference size, as that information allows for (1) guaranteed availability and (2) algorithm selection.

REQ-C3 open issue
If we consider media encryption to be a yes/no or strength question, it is a CPCP thing.  E.g., if you cannot encrypt the stream, don't establish a session.  Specifying the keys is a key distribution issue, which is again an "appropriate authentication and distribution" issue.  For example, there is no key distribution with public keys.

I would list REQ-E3 before REQ-E2.  I would also add that the protocol will not allow conflicting ACL definitions for fully-qualified targets.

REQ-E4
Hidden and anonymous users are two different things.  I would split the requirement.

REQ-CP-1
Given REQ-CP-2, doesn't the protocol have to be reliable?  That bumps REQ-CP-1 to MUST strength.

---

From: rohan at cisco.com (Rohan Mahy)
Date: Tue Jul 15 06:44:00 2003

> Hidden and anonymous users are two different things.  I would split 

I would like to second Eric's comment here.  I asked for this at one 
point but I think it fell through the cracks.

thanks,
-rohan